This functionality is in beta and is subject to change. The design and
code is considered to be less mature than official GA features. Elastic will
take a best effort approach to fix any issues, but beta features are not
subject to the support SLA of official GA features.

The list of Elasticsearch nodes to connect to. The events are distributed to
these nodes in round robin order. If one node becomes unreachable, the event is
automatically sent to another node. Each Elasticsearch node can be defined as a URL or IP:PORT.
For example: http://192.15.3.2, https://es.found.io:9230 or 192.24.3.2:9300.
If no port is specified, 9200 is used.

When a node is defined as an IP:PORT, the scheme and path are taken from the
protocol and path config options.

The number of workers per configured host publishing events to Elasticsearch. This
is best used with load balancing mode enabled. Example: If you have 2 hosts and
3 workers, in total 6 workers are started (3 for each host).

The name of the protocol Elasticsearch is reachable on. The options are:
http or https. The default is http. However, if you specify a URL for
hosts, the value of protocol is overridden by whatever scheme you
specify in the URL.

The URL of the proxy to use when connecting to the Elasticsearch servers. The
value may be either a complete URL or a "host[:port]", in which case the "http"
scheme is assumed. If a value is not specified through the configuration file
then proxy environment variables are used. See the
golang documentation
for more information about the environment variables.

Array of index selector rules supporting conditionals, format string
based field access and name mappings. The first rule matching will be used to
set the index for the event to be published. If indices is missing or no
rule matches, the index field will be used.

Rule settings:

index: The index format string to use. If the fields used are missing, the rule fails.

mapping: Dictionary mapping index names to new names

default: Default string value if mapping does not find a match.

when: Condition which must succeed in order to execute the current rule.

Similar to the indices array, this is an array of pipeline selector
configurations supporting conditionals, format string based field access
and name mappings. The first rule matching will be used to set the
pipeline for the event to be published. If pipelines is missing or
no rule matches, the pipeline field will be used.

In the default configuration, Heartbeat automatically checks the
Elasticsearch version and loads the recommended template file for the particular
version. This behaviour can be controlled from the following options:

2x.path

The path to the template file to load for
Elasticsearch versions 2.x.y. The default is heartbeat.template-es2x.json.

2x.enabled

If set to false, the 2x.path option is ignored and the
default template is loaded regardless of the Elasticsearch version.

The number of times to retry publishing an event after a publishing failure.
After the specified number of retries, the events are typically dropped.
Some Beats, such as Filebeat, ignore the max_retries setting and retry until all
events are published.

Set max_retries to a value less than 0 to retry until all events are published.

Setting bulk_max_size to values less than or equal to 0 disables buffering in libbeat. When buffering is disabled,
Beats that publish single events (such as Packetbeat) send each event directly to
Elasticsearch. Beats that publish data in batches (such as Filebeat) send events in batches based on the
spooler size.